Consent Management

Consent management is the way a financial firm captures, stores, shows and acts on a customer's permission to share account data or to make payments on the customer's behalf. In open banking it covers the whole life of a permission: the request a third party makes, the customer's agreement, the authentication at the customer's bank, the record of what was agreed, and later changes such as renewal, expiry or withdrawal. Good consent management lets customers see and control who can use their data and money.

The term is also used more widely for the handling of permissions under privacy law, such as cookie banners and marketing preferences, often through a consent management platform. In payments and banking, however, it usually means the narrower, regulated flow between a customer, a third-party provider and the bank that holds the account, known as the account servicing payment service provider.

Under the European Union's PSD2 and the United Kingdom's equivalent rules, licensed third parties may access payment accounts only with the customer's explicit consent. An account information service provider needs consent to read balances and transactions, and a payment initiation service provider needs consent to start a payment. Data protection law adds its own requirements on lawful use, purpose and retention. Consent is therefore both a legal condition and the main source of customer trust in data sharing.

1. The customer chooses to connect an account inside the third party's app and is shown what data will be accessed, for what purpose and for how long.
2. The third party creates a consent object, often through the bank's open banking API, describing the permissions requested.
3. The customer is sent to the bank, authenticates using strong customer authentication and confirms which accounts to share.
4. The bank issues access credentials linked to that consent, and the third party uses them only within its scope.
5. Both firms record the consent, and the customer can later review, renew or end it.

Most regimes expect customers to be able to see and manage their consents. Third parties usually provide a list of connected accounts with expiry dates, and banks often offer an access dashboard showing which providers hold live permissions. Records must show who agreed to what, when and how, so that firms can answer complaints and demonstrate compliance. Consent records also have to stay in step across the two firms, because a permission withdrawn at the bank must stop working for the third party.

Some markets have moved towards central consent infrastructure. Industry directories and trust frameworks, such as an open banking directory, let banks confirm that a third party is authorised before honouring a consent, and some data-sharing regimes outside payments, such as consumer data rights frameworks, define consent rules in law in considerable detail. Where several aggregators sit between the customer and the bank, each layer must pass consent information accurately so that the customer's choices are respected at every step.

• Granting. The first agreement, with defined permissions, accounts and duration.
• Amendment. A change of scope, such as adding an account, which normally needs fresh agreement.
• Renewal. Extending a time-limited permission; see consent renewal.
• Revocation. The customer withdrawing permission at either firm; see consent revocation.
• Expiry. The permission lapsing automatically when its end date passes.

For recurring payment permissions, such as a variable recurring payment mandate, consent also carries limits on amount, frequency and payee, which the bank must enforce on each payment.

Consent screens must be clear and free of pre-ticked boxes or misleading wording. Regulators and industry standards bodies have published customer experience guidelines that limit the number of steps and require plain descriptions of data clusters, such as account details, balances and transactions. Firms must also avoid using data beyond the agreed purpose, for example for marketing, without a separate lawful basis. On the technical side, consent identifiers, tokens and audit logs must be secured, and systems must handle edge cases such as closed accounts, joint accounts and business accounts with several authorised users. Weak consent management can lead to complaints, regulatory action and loss of customer trust, while strong design is a competitive advantage for embedded finance and data aggregation services.

• European Banking Authority
• Open Banking Limited